9d9f413785f6be15acc884bd430b5763384ced8f5c9d7c3845aaeb6bd3de7a6a

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 12:47

Target

633c8023af44ec4931fceec2153c9733_JaffaCakes118.dll
Size

28KB
MD5

633c8023af44ec4931fceec2153c9733
SHA1

1703f32280c7d354194493d4848af3ce7b430d44
SHA256

9d9f413785f6be15acc884bd430b5763384ced8f5c9d7c3845aaeb6bd3de7a6a
SHA512

da43e895149babd08ac678189492094337c49c34308412a07abe9fad07c785636b3292abf1393f17d8be9e8c63dc1fa104391b87bd565d76fa2a109bf002d2ac
SSDEEP

768:xaYeUqx+oEp8mPSczWw8FNUDodmrTHn65TMZ:Xen+oEp8mPSleokoQ

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4356	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 4356	1840	rundll32.exe	84
PID 1840 wrote to memory of 4356	1840	rundll32.exe	84
PID 1840 wrote to memory of 4356	1840	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\633c8023af44ec4931fceec2153c9733_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\633c8023af44ec4931fceec2153c9733_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4356